P7 DarkSword implant HTTP/1.0 JSON POST C2 beacon with hardcoded iPhone 18.5 User-Agent

Arnold Chan@slaz

•updated 4 days ago•0•0•1

Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.